diff --git a/libavformat/ape.c b/libavformat/ape.c index ca00242813..db00b8d84d 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -325,6 +325,8 @@ static int ape_read_header(AVFormatContext * s) ape->frames[i].pos -= ape->frames[i].skip; ape->frames[i].size += ape->frames[i].skip; } + if (ape->frames[i].size > INT_MAX - 3) + return AVERROR_INVALIDDATA; ape->frames[i].size = (ape->frames[i].size + 3) & ~3; } if (ape->fileversion < 3810) {